Canadian privacy & access decisions

An individual complained that a bank failed to obtain proper consent for the collection, use, or disclosure of personal information for secondary marketing purposes. The complainant alleged that the bank did not adequately inform customers of its data sharing practices with affiliates, failed to provide clear information on potential secondary uses, and did not offer an easy opt-out mechanism. The OPC investigated the bank's privacy materials and processes, finding that the bank provided two privacy documents to customers and had a detailed privacy code available online or in paper format. The bank also had a process where representatives drew attention to privacy policies and recorded customer preferences regarding disclosure to affiliates. The Commissioner found that the bank's materials and processes constituted a reasonable effort to inform individuals and allow them to refuse or withdraw consent. The complaint was therefore found to be not well-founded.

• Whether the bank obtained adequate knowledge and consent for secondary marketing purposes under Principle 4.3
• Whether the bank made a reasonable effort to advise individuals of the purposes for which information would be used, as required by Principle 4.3.2
• Whether the purposes were stated in a manner that individuals could reasonably understand, as per Principle 4.3.2
• Whether the bank considered the reasonable expectations of the individual in obtaining consent, as per Principle 4.3.5

The OPC initiated an investigation after a news report revealed an Ottawa-based website was streaming live cell phone conversations. The website was using a scanner to intercept cellular telephone traffic and broadcasting it online. During the investigation, the Internet Service Provider (ISP) hosting the website shut it down due to bandwidth issues. The ISP also terminated an employee who was responsible for the unauthorized data forwarding. The website reportedly moved to a New York server under new management. Given the shutdown of the Ottawa-based site, the OPC discontinued its investigation.

• Whether broadcasting cell phone conversations without consent constitutes unauthorized collection, use, or disclosure of personal information under PIPEDA
• Whether the OPC should continue an investigation when the alleged activity has ceased

A complaint was made against a transportation company alleging that its sales agents were collecting passengers' date of birth and citizenship for Toronto-to-New York train bookings and disclosing this information to US Customs and US Naturalization and Immigration Service. The company confirmed this practice, stating it was an agreement with US authorities to minimize border delays. The OPC found that sales agents were representing the provision of this information as a requirement. The OPC advised the company to instruct its agents to present the provision of this information as voluntary and to seek consent after booking. The company issued a directive to its sales agents, and the OPC closed the file, subject to monitoring.

• Whether the transportation company was collecting personal information without proper consent
• Whether the transportation company was disclosing personal information without proper consent
• Whether sales agents were misrepresenting the voluntary nature of providing personal information

The complainant alleged that a federal institution failed to respond to an access request within the statutory 30-day period or an extended period, resulting in a deemed refusal under subsection 10(3) of the Access to Information Act. The complainant submitted their complaint on January 21, 2025, arguing that the deemed refusal was 'ongoing' and therefore the 60-day time limit for complaints under section 31 should not apply from the initial awareness date. The OIC requested clarification on when the complainant first became aware of the institution's failure to respond, but the complainant maintained their 'ongoing refusal' position. The OIC determined that the complaint was inadmissible because it was not submitted within the mandatory 60-day time limit from when the complainant first became aware of the grounds for complaint. The Commissioner rejected the argument that an 'ongoing' deemed refusal continuously restarts the complaint period, citing Federal Court precedent and emphasizing that the Act does not grant the Commissioner power to extend this time limit.

• Whether the complaint was submitted within the 60-day time limit prescribed by section 31 of the Access to Information Act
• Whether an 'ongoing' deemed refusal under subsection 10(3) of the Act continuously restarts the 60-day complaint period under section 31
• Whether the Information Commissioner has the power to extend the 60-day time limit for submitting complaints

The Information Commissioner ceased investigation into seventeen complaints, finding them vexatious. The complaints alleged unreasonable time extensions taken by an institution. However, the Commissioner found that these seventeen requests sought the same information as a previous request from the same complainant, which had already been the subject of an OIC investigation where the time extension was deemed reasonable. The complainant had not pursued a Federal Court review of the previous finding. Evidence showed the institution was providing regular interim responses as committed, contrary to the complainant's assertion. The Commissioner concluded that the new complaints were an attempt to circumvent the OIC's previous findings and avoid the proper recourse mechanism of Federal Court review. Therefore, the Commissioner ceased investigation under paragraphs 30(4)(a) and (b) of the Access to Information Act.

• Whether the complaints were vexatious under s.30(4)(a) ATIA
• Whether further investigation was unnecessary under s.30(4)(b) ATIA
• Whether the new requests were substantively duplicative of a previously investigated complaint
• Whether the complainant was attempting to circumvent previous OIC findings

The complainant submitted an access to information request to a federal institution and received a response in October 2021. The institution's response included a notice informing the complainant of their right to complain to the Information Commissioner within sixty days. The complainant filed a complaint with the Office of the Information Commissioner (OIC) in January 2022, which was more than sixty days after receiving the institution's response. The OIC determined that the complaint was submitted outside the mandatory 60-day timeframe specified in section 31 of the Access to Information Act. Citing legal precedents, the Commissioner concluded that the OIC does not have the authority to extend statutory timeframes. Consequently, the complaint was rejected.

• Whether the complaint was filed within the 60-day statutory timeframe as per s.31 of the Access to Information Act
• Whether the Information Commissioner has the authority to extend the statutory timeframe for filing a complaint

A federal institution applied to the Information Commissioner for approval to decline to act on an access request under subsection 6.1(1) of the Access to Information Act. The institution argued that it had already disclosed some of the requested information to the same requester through an informal request, and processing the formal request would be duplicative. The institution sought to limit the scope of the formal request by excluding the time period covered by the informal release. However, the Commissioner found that the institution did not adequately explain how the records would be duplicates, noting that the subject matter and type of records appeared different. The Commissioner also considered that the formal request might be seeking a present-day review of redactions applied to previously released records. Crucially, the institution failed to specify which criteria under subsection 6.1(1) (vexatious, bad faith, or abuse of right) it was relying on, nor did it provide sufficient evidence to support its claim of duplication meeting these criteria. Consequently, the Commissioner denied the application, requiring the institution to process the request.

• Whether the access request was vexatious under s.6.1(1) ATIA
• Whether the access request was made in bad faith under s.6.1(1) ATIA
• Whether the access request was an abuse of the right of access under s.6.1(1) ATIA
• Whether the institution provided sufficient evidence to support its s.6.1 application
• Whether the institution's application was complete according to OIC guidance